TOTP 2FA Generator

TOTP makes the six-digit code of a two-factor app. It combines a shared secret with the current time, so the code changes every 30 seconds.

Give a Base32 secret or a full otpauth:// URI. The tool shows the current code and the seconds until the next code. Use it to test a login flow or to check that your server and your app agree.

A screen reader reads the new code when the code changes. The progress bar reports the seconds until the next code, but it does not interrupt the user each second.

The tool masks the secret key. Use the eye button to show it or to hide it. The tool keeps the secret in the page memory only. It writes no secret to local storage.

The tool also shows the offset between this device and the Date response header of this site. A large offset explains most failures of TOTP. The header holds whole seconds, so the offset is correct to one second only.

Set a fixed test time to freeze the clock. The tool then gives the same code each time, so you can repeat a test. Clear the field to follow the clock of this device again.

The tool also shows the otpauth URI for the current settings. Copy the URI and give it to an authenticator app or to a test script. The tool builds the URI in the browser and sends the secret to no other host.

The tool supports SHA-1, SHA-256, and SHA-512. SHA-1 is the default, because almost every authenticator app uses it. Change the algorithm only when your server asks for a different one.

The clock of the server and the clock of the device must agree. Most of the failures of TOTP come from a clock that has drifted, and not from a wrong secret. Do not put a real production secret into any web tool.